gitgabrio commented on code in PR #6869:
URL: https://github.com/apache/incubator-kie/pull/6869#discussion_r3719486823
##########
kie-parent/pom.xml:
##########
@@ -2133,6 +2138,14 @@
<artifactId>log4j-over-slf4j</artifactId>
<version>${version.org.slf4j}</version>
</dependency>
+ <dependency>
Review Comment:
HI @athirakm94
Please keep the versions ordered, otherwise this file will become a
nightmare to manage.
I spent a huge amount of time exactly for that reason 😄
##########
kogito-springboot/bom/pom.xml:
##########
@@ -48,9 +48,32 @@
2025.1.1 specifically targets Spring Boot 4.0.1+. -->
<!--
https://github.com/spring-cloud/spring-cloud-release/wiki/Spring-Cloud-2025.1-Release-Notes
-->
<version.org.springframework.cloud>2025.1.1</version.org.springframework.cloud>
+ <!-- CVE-2026-49844: override log4j2.version used by
spring-boot-dependencies BOM (log4j-bom import).
+ Spring Boot 4.0.7 sets log4j2.version=2.25.4 which is vulnerable;
upgrade to 2.26.1 (minimum 2.25.5).
+ https://logging.apache.org/security.html#CVE-2026-49844 -->
+ <log4j2.version>2.26.1</log4j2.version>
</properties>
<dependencyManagement>
<dependencies>
+ <!-- CVE-2026-49844: Explicit log4j version overrides BEFORE
spring-boot-dependencies and spring-cloud-dependencies
+ imports. Maven's first-declaration-wins rule means these entries
take precedence over the hardcoded
+ log4j-api/log4j-to-slf4j/log4j-jul:2.25.4 versions inside
spring-boot-dependencies-4.0.7.pom.
+ https://logging.apache.org/security.html#CVE-2026-49844 -->
+ <dependency>
Review Comment:
@athirakm94
Those are not needed - the only required change is the override of the
version property
##########
kogito-springboot/bom/pom.xml:
##########
@@ -48,9 +48,32 @@
2025.1.1 specifically targets Spring Boot 4.0.1+. -->
<!--
https://github.com/spring-cloud/spring-cloud-release/wiki/Spring-Cloud-2025.1-Release-Notes
-->
<version.org.springframework.cloud>2025.1.1</version.org.springframework.cloud>
+ <!-- CVE-2026-49844: override log4j2.version used by
spring-boot-dependencies BOM (log4j-bom import).
+ Spring Boot 4.0.7 sets log4j2.version=2.25.4 which is vulnerable;
upgrade to 2.26.1 (minimum 2.25.5).
+ https://logging.apache.org/security.html#CVE-2026-49844 -->
+ <log4j2.version>2.26.1</log4j2.version>
Review Comment:
HI @athirakm94
This is the wrong approach.
To override the versions, you just need to override the variable, i.e.
`<version.org.apache.logging.log4j>2.26.1</version.org.apache.logging.log4j>`
##########
kie-parent/pom.xml:
##########
@@ -287,6 +287,11 @@
<version.org.rocksdb>7.10.2</version.org.rocksdb>
<version.org.skyscreamer>1.5.1</version.org.skyscreamer>
<version.org.slf4j>2.0.17</version.org.slf4j>
+ <!-- CVE-2026-49844: poi-ooxml:5.4.1 pulls log4j-api:2.24.3 transitively
via log4j-bom:2.24.3.
+ quarkus-bom:3.27.4.1 promotes it to 2.25.1. Both are below the
minimum safe version 2.25.5.
+ This managed entry forces 2.26.1 across all modules inheriting
kie-parent.
+ https://logging.apache.org/security.html#CVE-2026-49844 -->
+ <version.org.apache.logging.log4j>2.26.1</version.org.apache.logging.log4j>
Review Comment:
HI @athirakm94
Please keep the versions ordered, otherwise this file will become a
nightmare to manage.
I spent a huge amount of time exactly for that reason 😄
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
